DMA Mapping Error Analysis October 2013

From Linux Driver Project

Revision as of 14:53, 17 October 2013 by Shuahkhan (Talk | contribs)

Jump to: navigation, search


DMA Mapping Error Check Analysis Octobe 2013

I re-analyzed the dma mapping error check status for the drivers that were identified in my first analysis.

Linux 3.12-rc5 October 2013 is used as the base for this analysis.

There are no significant changes in the percentages. Awesome progress made fixing Intel drivers by the Intel driver developres since the last analysis. This is a result of debug_dma_mapping_error() interface generating warnings on drivers that aren't checking mapping errors. I am pleased with the results so far, but more needs to be done. I simply updated the tables with the latest status.

I classified the results into three categories, Broken, Partially Broken, Unmap Broken, and Good. Details below:

  1. Broken - No dma mapping error checks done on the returned address.
  2. Partially Broken - In that source file, not all calls are followed by mapping error checks.
  3. Unmap broken - Checks dma mapping errors, however doesn't unmap already mapped pages when mapping error occurs in the middle of a multiple page mapping attempt.

The first two categories Broken, and Partially Broken are classified as severe and need fixing. The third one needs fixing, since it leaves dangling mapped pages, and holds on to them which is equivalent to a memory leak condition. Some drivers release all mapped pages when the device closes, but others don't. Not doing unmap might be harmless on some architectures going by the comments I found in some source files.

  1. Checks dma mapping errors and unmaps already mapped pages when mapping error occurs in the middle of a multiple page mapping attempt.
  2. Checks dma mapping errors without unlikely()
  3. Checks dma mapping errors with unlikely()

I grouped the above three cases as good cases. Using unlikely() is icing on the cake, and something we don't need to be concerned about considering the other more serious problems in this area.

dmap_map_single() - results

  • Broken - 195 (46%)
  • Partially broken - 46 (11%)
  • Unmap broken: 26 (6%)
  • Good: 147 (35%)

dma_map_page() - results

  • Broken: 61 (59%)
  • Partially broken: 7 (.06%)
  • Unmap broken: 15 (14.5%)
  • Good: 20 (19%)

In summary, a large % of the cases (> 50%) go unchecked. This raises the following questions:

  • When do mapping errors get detected?
  • How often do these errors occur?
  • Why don't we see failures related to missing dma mapping error checks?
  • Are they silent failures?

I propose the following next steps to gather more information and understand the severity of the problem.

Next Steps

Continue to assess severity and fix drivers and modules as needed. Look into possible enhancements to DMA-Debug API.

If you have comments, questions etc. please contact [Shuah Khan]

Detailed Analysis

The following is the detailed information on the nature of problems with dma mapping error checking, ranging from not checking mapping errors, doing partial checks, not unmapping, and checking and unmapping correctly.

dma_map_single() usages and error checking status

The following table lists the source files that call dma_map_single() and whether or not dma mapping errors are checked on the returned address. Also includes the status that indicates the cases that are broken and need fixing. Observations and open issues if any are captured in the Notes column. Individual driver and module owners can assess the severity of the broken cases.

Broken - Not fixed in 3.12-rc5 as of Oct 2013
File Name # of calls Status Notes
arch/arm/mach-rpc/dma.c 1 Broken
arch/arm/kernel/dma-isa.c 1 Broken
drivers/parport/parport_pc.c 1 Broken
drivers/parport/parport_ip32.c 1 Broken
drivers/infiniband/core/mad.c 3 Broken
drivers/atm/fore200e.c 1 Broken
drivers/tty/serial/msm_serial_hs.c 5 Broken
drivers/tty/serial/atmel_serial.c 2 Broken
drivers/tty/serial/mfd.c 2 Broken
drivers/spi/spi-stmp.c 1 File removed (not in 3.12-rc5)
drivers/dma/mv_xor.c 2 Broken
drivers/dma/dmaengine.c 3 Broken
drivers/dma/iop-adma.c 2 Broken
drivers/dma/dw_dmac.c 1 File removed (not in 3.12-rc5)
drivers/dma/ioat/dma.c 2 Broken
drivers/dma/txx9dmac.c 1 Broken
drivers/mtd/nand/fsmc_nand.c 1 Broken
drivers/scsi/initio.c 1 Broken
drivers/scsi/isci/request.c 1 Broken
drivers/scsi/sgiwd93.c 1 Broken
drivers/scsi/sun_esp.c 1 Broken
drivers/scsi/jazz_esp.c 1 Broken
drivers/scsi/53c700.c 2 Broken
drivers/scsi/sun3x_esp.c 1 Broken do sun3x_esp_map_single() callers check errors?
drivers/scsi/qla4xxx/ql4_os.c 1 Broken
drivers/usb/host/whci/qset.c 3 Broken
drivers/usb/musb/tusb6010_omap.c 2 Broken
drivers/usb/core/usb.c 1 Cleanup The code is #ifdef'ed out. It hasn't been used in many years; it should be removed.
drivers/usb/gadget/atmel_usba_udc.c 1 Broken
drivers/usb/gadget/mv_udc_core.c 2 Broken
drivers/usb/gadget/fsl_udc_core.c 3 Broken
drivers/usb/gadget/lpc32xx_udc.c 1 Broken
drivers/usb/gadget/mv_u3d_core.c 1 Broken
drivers/usb/gadget/pch_udc.c 5 Broken
drivers/usb/gadget/fsl_qe_udc.c 3 Broken
drivers/video/grvga.c 1 Broken
drivers/staging/et131x/et131x.c 9 Broken
drivers/mmc/host/mmc_spi.c 2 Broken
drivers/media/platform/vino.c 3 Broken
drivers/gpu/drm/via/via_dmablit.c 1 Broken
drivers/vme/bridges/vme_tsi148.c 2 Broken
drivers/message/i2o/memory.c 4 Broken i2o_dma_map_single() checks mapping error, but returns bad address - couldn't find any i2o_dma_map_single() callers.
drivers/net/ethernet/ibm/emac/core.c 6 Broken
drivers/net/ethernet/sun/sunbmac.c 3 Broken
drivers/net/ethernet/sun/niu.c 1 Broken
drivers/net/ethernet/sun/sunhme.c 5 Broken
drivers/net/ethernet/sgi/meth.c 5 Broken
drivers/net/ethernet/smsc/smc91x.h 2 Broken
drivers/net/ethernet/smsc/smc911x.h 2 Broken
drivers/net/ethernet/tundra/tsi108_eth.c 2 Broken
drivers/net/ethernet/stmicro/stmmac/ring_mode.c 3 Broken
drivers/net/ethernet/stmicro/stmmac/chain_mode.c 3 Broken
drivers/net/ethernet/stmicro/stmmac/stmmac_main.c 3 Broken
drivers/net/ethernet/brocade/bna/bnad.c 2 Broken
drivers/net/ethernet/ti/cpmac.c 3 Broken
drivers/net/ethernet/seeq/sgiseeq.c 3 Broken
drivers/net/ethernet/freescale/fec_mpc52xx.c 2 Broken
drivers/net/ethernet/freescale/fec_main.c 3 Broken
drivers/net/ethernet/freescale/fs_enet/fs_enet-main.c 4 Broken - New or moved file
drivers/net/ethernet/freescale/fec_mpc52xx.c.c 2 Broken - New file
drivers/net/ethernet/freescale/ucc_geth.c 2 Broken
drivers/net/ethernet/freescale/gianfar.c 2 Broken
drivers/net/ethernet/xilinx/ll_temac_main.c 4 Broken
drivers/net/ethernet/xilinx/xilinx_axienet_main.c 4 Broken
drivers/net/ethernet/lantiq_etop.c 2 Broken
drivers/net/ethernet/renesas/sh_eth.c 3 Broken
drivers/net/ethernet/marvell/mv643xx_eth.c 2 Broken
drivers/net/ethernet/marvell/pxa168_eth.c 2 Broken
drivers/net/ethernet/cadence/at91_ether.c 1 Broken
drivers/net/ethernet/cadence/macb.c 1 Broken
drivers/net/ethernet/dec/tulip/de4x5.c 1 Broken
drivers/net/ethernet/i825xx/lib82596.c 3 Broken
drivers/net/ethernet/octeon/octeon_mgmt.c 4 Broken
drivers/net/ethernet/broadcom/bcm63xx_enet.c 2 Broken
drivers/net/fddi/defxx.c 3 Broken
drivers/crypto/talitos.c 3 Broken
drivers/crypto/ixp4xx_crypto.c 1 Broken
drivers/crypto/picoxcell_crypto.c 1 Broken
drivers/crypto/bfin_crc.c 2 Broken
drivers/crypto/caam/ctrl.c 1 Broken
drivers/crypto/caam/caamrng.c 2 Broken
include/asm-generic/pci-dma-compat.h 1 Broken do pci_map_single() callers check errors?
sound/soc/sh/fsi.c 1 Broken
sound/sparc/dbri.c 1 Broken
Partially Broken - Not fixed in 3.12-rc5 as of Oct 2013
File Name # of calls Status Notes
drivers/scsi/advansys.c 2 Partially Broken driver is still not properly converted to the DMA API - please read FIXME in this file for details on what is broken and what needs to be fixed.
drivers/mmc/host/wbsd.c 1 Partially Broken Checks returned address is aligned on 64k - however doesn't call dma_mapping_error()
drivers/crypto/caam/caamhash.c 20 Partially Broken
drivers/crypto/caam/caamalg.c 13 Partially Broken
net/sunrpc/xprtrdma/verbs.c 1 Partially Broken
Unmap Broken - Not fixed in 3.12-rc5 as of Oct 2013
File Name # of calls Status Notes
drivers/infiniband/ulp/iser/iser_verbs.c 2 Unmap Broken
drivers/mtd/onenand/omap2.c 4 Unmap Broken
drivers/net/ethernet/ibm/ibmveth.c 6 Unmap Broken
drivers/net/ethernet/intel/e1000e/netdev.c 3 Unmap Broken
drivers/net/ethernet/dlink/sundance.c 3 Unmap Broken
drivers/net/ethernet/xscale/ixp4xx_eth.c 3 Unmap Broken
drivers/net/ethernet/sfc/rx.c 1 Unmap Broken
drivers/net/ethernet/oki-semi/pch_gbe/pch_gbe_main.c 2 Unmap Broken
drivers/net/wan/ixp4xx_hss.c 3 Unmap Broken
Fixed in 3.12-rc5 as of Oct 2013
File Name # of calls Status Notes
drivers/dma/dmatest.c 2 FIXED
drivers/usb/musb/musb_gadget.c 1 FIXED
drivers/net/wireless/rt2x00/rt2x00queue.c 2 FIXED
drivers/net/wireless/brcm80211/brcmsmac/dma.c 2 FIXED
drivers/net/ethernet/ti/davinci_cpdma.c 1 FIXED
drivers/net/ethernet/mellanox/mlx4/en_tx.c 1 FIXED
drivers/net/ethernet/intel/e1000/e1000_ethtool.c 2 FIXED
drivers/net/ethernet/realtek/8139cp.c 5 FIXED
drivers/net/ethernet/intel/ixgb/ixgb_main.c 2 FIXED
drivers/net/ethernet/intel/ixgbevf/ixgbevf_main.c 2 FIXED
drivers/net/ethernet/intel/igbvf/netdev.c 2 FIXED
drivers/net/ethernet/calxeda/xgmac.c 2 FIXED
File Name # of calls Status Notes
arch/powerpc/platforms/cell/celleb_scc_pciex.c 1 Good
arch/powerpc/platforms/cell/spider-pci.c 1 Good
arch/c6x/include/asm/dma-mapping.h 1 Good
arch/c6x/kernel/dma.c 1 Good
drivers/infiniband/hw/qib/qib_sdma.c 1 Good
drivers/infiniband/hw/qib/qib_verbs.c 1 Good
drivers/infiniband/hw/ipath/ipath_sdma.c 2 Good
drivers/infiniband/ulp/ipoib/ipoib_ib.c 2 Good
drivers/infiniband/ulp/ipoib/ipoib_cm.c 2 Good
drivers/infiniband/ulp/srpt/ib_srpt.c 1 Good
drivers/infiniband/ulp/iser/iser_initiator.c 1 Good
drivers/infiniband/ulp/iser/iscsi_iser.c 1 Good
drivers/infiniband/ulp/srp/ib_srp.c 2 Good
drivers/spi/spi-au1550.c 3 Good
drivers/spi/spi-atmel.c 2 Good
drivers/spi/spi-omap2-mcspi.c 2 Good
drivers/spi/spi-davinci.c 2 Good
drivers/spi/spi-fsl-spi.c 4 Good
drivers/spi/spi-pxa2xx.c 2 Good
drivers/spi/spi-s3c64xx.c 4 Good
drivers/dma/ste_dma40.c 2 Good
drivers/dma/timb_dma.c 1 Good
drivers/mtd/onenand/samsung.c 1 Good
drivers/mtd/nand/gpmi-nand/gpmi-nand.c 2 Good
drivers/mtd/nand/atmel_nand.c 2 Good
drivers/mtd/nand/denali.c 1 Good
drivers/scsi/ibmvscsi/ibmvstgt.c 1 Good
drivers/scsi/ibmvscsi/ibmvfc.c 2 Good
drivers/scsi/ibmvscsi/rpa_vscsi.c 1 Good
drivers/scsi/ibmvscsi/ibmvscsi.c 3 Good
drivers/scsi/aha1740.c 1 Good
drivers/usb/host/imx21-hcd.c 1 Good
drivers/usb/core/hcd.c 2 Good
drivers/usb/gadget/fusb300_udc.c 1 Good
drivers/usb/gadget/s3c-hsotg.c 2 Good
drivers/usb/gadget/udc-core.c 1 Good
drivers/staging/rts_pstor/rtsx_transport.c 1 Good
drivers/mmc/host/sdhci.c 2 Good
drivers/media/video/videobuf-dma-contig.c 2 Good
drivers/media/video/omap/omap_vout.c 2 Good
drivers/firewire/ohci.c 1 Good
drivers/firewire/sbp2.c 4 Good
drivers/message/i2o/iop.c 1 Good
drivers/net/wireless/ath/ath9k/xmit.c 1 Good
drivers/net/wireless/ath/ath9k/beacon.c 1 Good
drivers/net/wireless/ath/ath9k/recv.c 3 Good
drivers/net/wireless/ath/ath5k/base.c 3 Good
drivers/net/wireless/b43legacy/dma.c 4 Good
drivers/net/wireless/b43/dma.c 4 Good
drivers/net/wireless/iwlwifi/pcie/trans.c 2 Good
drivers/net/wireless/iwlwifi/pcie/tx.c 2 Good
drivers/net/ethernet/aeroflex/greth.c 5 Good
drivers/net/ethernet/natsemi/sonic.c 3 Good
drivers/net/ethernet/cirrus/ep93xx_eth.c 2 Good
drivers/net/ethernet/faraday/ftmac100.c 1 Good
drivers/net/ethernet/micrel/ks8842.c 2 Good
drivers/net/ethernet/micrel/ks8695net.c 2 Good
drivers/net/ethernet/intel/e1000e/ethtool.c 2 Good
drivers/net/ethernet/intel/igb/igb_main.c 2 Good
drivers/net/ethernet/intel/e1000/e1000_main.c 2 Good
drivers/net/ethernet/intel/ixgbe/ixgbe_fcoe.c 1 Good
drivers/net/ethernet/intel/ixgbe/ixgbe_main.c 1 Good
drivers/net/ethernet/toshiba/ps3_gelic_net.c 3 Good
drivers/net/ethernet/realtek/r8169.c 3 Good
drivers/net/ethernet/sfc/tx.c 4 Good
drivers/net/ethernet/emulex/benet/be_main.c 1 Good
drivers/net/ethernet/chelsio/cxgb4vf/sge.c 2 Good
drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c 3 Good
drivers/net/ethernet/broadcom/bnx2x/bnx2x_ethtool.c 1 Good
drivers/net/ethernet/broadcom/bnx2.c 3 Good
drivers/net/ethernet/broadcom/b44.c 6 Good
drivers/ps3/ps3stor_lib.c 1 Good
drivers/crypto/atmel-tdes.c 2 Good
drivers/crypto/atmel-sha.c 2 Good
drivers/crypto/omap-aes.c 2 Good
drivers/crypto/omap-sham.c 1 Good
drivers/crypto/caam/jr.c 1 Good
drivers/crypto/caam/key_gen.c 2 Good
net/9p/trans_rdma.c 2 Good
dma_map_page() usages and error checking status

The following table lists the source files that call dma_map_page() and whether or not dma mapping errors are checked on the returned address. Also includes the status that indicates the cases that are broken and need fixing. Observations and open issues if any are captured in the Notes column. Individual driver and module owners can assess the severity of the broken cases.

Broken - Not fixed in 3.12-rc5 as of Oct 2013
File Name # of calls Status Notes
crypto/async_tx/async_pq.c 7 Broken
crypto/async_tx/async_memcpy.c 2 Broken
crypto/async_tx/async_raid6_recov.c 5 Broken
drivers/dma/mv_xor.c 2 Broken
drivers/dma/dmaengine.c 3 Broken
drivers/dma/iop-adma.c 10 Broken
drivers/dma/ioat/dma_v3.c 5 Broken
drivers/dma/ppc4xx/adma.c 3 Broken
drivers/staging/omapdrm/omap_gem.c 2 Broken
drivers/staging/et131x/et131x.c 2 Broken
drivers/staging/sep/sep_main.c 1 Broken
drivers/mmc/host/mmc_spi.c 1 Broken
drivers/gpu/drm/via/via_dmablit.c 1 Broken
drivers/net/ethernet/ibm/emac/core.c 2 Broken
drivers/net/ethernet/intel/igbvf/netdev.c 1 Broken
drivers/net/ethernet/emulex/benet/be_main.c 1 Broken
drivers/crypto/amcc/crypto4xx_core.c 5 Broken
Partially Broken - Not fixed in 3.12-rc5 as of Oct 2013
File Name # of calls Status Notes
drivers/net/ethernet/intel/e1000e/netdev.c 2 Partially Broken
net/sunrpc/xprtrdma/svc_rdma_sendto.c 5 Partially Broken
Unmap Broken - Not fixed in 3.12-rc5 as of Oct 2013
File Name # of calls Status Notes
drivers/infiniband/hw/qib/qib_user_sdma.c 3 Unmap Broken
drivers/infiniband/hw/ipath/ipath_user_sdma.c 3 Unmap Broken
drivers/firewire/core-iso.c 1 Unmap Broken On failure, the callers are responsible for cleanup by calling fw_iso_buffer_destroy() eventually. ioctl_create_iso_context() doesn't do this correctly if it's called multiple times.
drivers/net/ethernet/sfc/rx.c 1 Unmap Broken
drivers/net/ethernet/chelsio/cxgb4vf/sge.c 2 Unmap Broken
drivers/net/ethernet/chelsio/cxgb4/sge.c 2 Unmap Broken
net/sunrpc/xprtrdma/svc_rdma_recvfrom.c 2 Unmap Broken
Fixed in 3.12-rc5 as of Oct 2013
File Name # of calls Status Notes
drivers/mtd/onenand/samsung.c 1 FIXED
drivers/net/wireless/iwlwifi/pcie/rx.c 2 FIXED
net/sunrpc/xprtrdma/verbs.c 1 FIXED
File Name # of calls Status Notes
drivers/infiniband/ulp/ipoib/ipoib_ib.c 2 Good
drivers/infiniband/ulp/ipoib/ipoib_cm.c 1 Good
drivers/firewire/ohci.c 1 Good ar_context_release() takes care of cleanup.
drivers/scsi/cxgbi/libcxgbi.c 1 Good
drivers/usb/core/hcd.c 1 Good
drivers/staging/media/go7007/saa7134-go7007.c 2 Good
drivers/net/ethernet/faraday/ftmac100.c 2 Good
drivers/net/ethernet/mellanox/mlx4/en_rx.c 2 Good
drivers/net/ethernet/intel/igb/igb_main.c 1 Good
drivers/net/ethernet/intel/e1000/e1000_main.c 1 Good
drivers/net/ethernet/intel/ixgbe/ixgbe_main.c 1 Good
drivers/net/ethernet/sfc/tx.c 1 Good
drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c 1 Good
drivers/net/ethernet/broadcom/bnx2.c 1 Good
net/rds/iw_recv.c 1 Good
net/sunrpc/xprtrdma/svc_rdma_transport.c 2 Good
Personal tools